---
id: "CVE-2026-107187"
kind: "vulnerability"
aliases: ["CVE-2026-107187"]
title: "Web app: DWR request exposes database usernames and passwords to users"
severity: "high"
cvss: 8.5
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Archibus", "fixed": ["2025.02", "2026.01", "2025.01 + hotfix WebCv2025.01.01.128_Hotfix-for-AD-24576"], "affected": "< 2025.02 (2025.01 unpatched and all earlier)", "ecosystem": "vendor"}]
ecosystems: []
tags: ["archibus", "dwr", "eptura", "facilities-management", "java", "other", "self-hosted", "unauthenticated"]
not_affected_if: ["archibus-2025.02-or-later", "hotfix-applied"]
published_at: "2026-10-19T17:17:00+00:00"
first_seen_at: "2026-10-23T21:57:18+00:00"
updated_at: "2026-10-25T03:40:27+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107187", "first_seen_at": "2026-10-23T21:57:18+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-25T03:40:27+00:00"}]
---

# Web app: DWR request exposes database usernames and passwords to users

Archibus Web Central's AbCommonResources-getDataRecords workflow rule, called over DWR, lets a user read any database table, including afm_users usernames and passwords. Chained with the DWR auth bypass CVE-2026-107186, no login is needed. The finder's PoC is in the Rapid7 post.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Archibus affected < 2025.02 (2025.01 unpatched and all earlier) fixed 2025.02, 2026.01, 2025.01 + hotfix WebCv2025.01.01.128_Hotfix-for-AD-24576

## How to check

Find Archibus Web Central servers (path /archibus/login.axvw, /archibus/dwr/). Check the version in the app: V.2025.01 and earlier are affected, V.2025.02 and V.2026.01 are not. For 2025.01, check that hotfix WebCv2025.01.01.128_Hotfix-for-AD-24576 is installed. Confirm with Eptura or your Archibus partner.

## Fix

Upgrade to Archibus V.2025.02 or V.2026.01. On 2025.01 apply hotfix WebCv2025.01.01.128_Hotfix-for-AD-24576 (via the Eptura partner portal). On 2024.04 and earlier (unsupported) apply Eptura's web.xml mitigation from Archibus Support, then upgrade. Per Eptura's notice as relayed by Safeguard; not read directly.

## Timeline

- 2026-10-23T21:57:18+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-107187
- 2026-10-25T03:40:27+00:00 analyst — Product is Eptura Archibus Web Central (Rapid7 CNA, finder Marcus Chang). Read Rapid7 write-up (finder, not vendor) with PoC request; fix details come from Safeguard's summary of Eptura's 21 Oct notice, which I could not read directly, so nothing marked verified. No exploitation reported (CISA SSVC none, not in KEV). Same chain as CVE-2026-107186 (auth bypass) and -107188 (RCE).

## Documents

- [advisory] Rapid7: Auth Bypass, RCE, and Database Read in Eptura Archibus https://www.rapid7.com/blog/post/ve-authentication-bypass-remote-code-execution-and-database-read-in-eptura-archibus-fixed/
- [describes] Rapid7 DB: CVE-2026-107187 https://www.rapid7.com/db/vulnerabilities/cve-2026-107187/
- [fix] Safeguard: Eptura Archibus CVE-2026-107186 (summarises Eptura notice) https://safeguard.sh/resources/blog/eptura-archibus-cve-2026-107186-auth-bypass-rce

## From the sources

A user can access any database details, such as usernames and passwords by sending a DWR request with a specified workflow rule. The authentication bypass vulnerability can be chained with this vulnerability to perform database reads without authentication. Database write and delete operations may also be possible, but this was untested.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_